{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/pan-os--12.1.10-h4/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-0331"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PAN-OS (\u003c 12.2.4-h2)","PAN-OS (\u003c 12.1.4-h14)","PAN-OS (\u003c 12.1.7-h12)","PAN-OS (\u003c 12.1.10-h4)","PAN-OS (\u003c 11.2.4-h24)","PAN-OS (\u003c 11.2.7-h24)","PAN-OS (\u003c 11.2.10-h18)","PAN-OS (\u003c 11.2.13-h5)","PAN-OS (\u003c 11.2.16-h2)","PAN-OS (\u003c 11.1.4-h39)","PAN-OS (\u003c 11.1.6-h41)","PAN-OS (\u003c 11.1.7-h13)","PAN-OS (\u003c 11.1.10-h37)","PAN-OS (\u003c 11.1.13-h17)","PAN-OS (\u003c 11.1.16-h5)","PAN-OS (\u003c 10.2.7-h40)","PAN-OS (\u003c 10.2.10-h43)","PAN-OS (\u003c 10.2.13-h28)","PAN-OS (\u003c 10.2.16-h13)","PAN-OS (\u003c 10.2.18-h14)","Prisma Access (\u003c 12.1.10-h4)","Prisma Access (\u003c 11.2.7-h24)","Prisma Access (\u003c 10.2.10-h43)","Cloud NGFW (All)"],"_cs_severities":["medium"],"_cs_tags":["cve","vulnerability","information-disclosure","network-security"],"_cs_type":"advisory","_cs_vendors":["Palo Alto Networks"],"content_html":"\u003cp\u003ePalo Alto Networks has disclosed a sensitive information disclosure vulnerability (CVE-2026-0331) in PAN-OS software. The vulnerability allows an unauthenticated remote attacker with network access to retrieve sensitive firewall and session information by sending crafted traffic to or through a dataplane interface. No special configuration is required for exposure, and the impact is higher on PA-Series and VM-Series firewalls. Panorama is not affected by this vulnerability.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation may allow for the exfiltration of sensitive information, including session-related data, which could facilitate further reconnaissance or network compromise. Palo Alto Networks has confirmed that the impact is lower for Prisma Access, as it requires an authenticated user and restricted external access.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all affected PA-Series and VM-Series firewalls to the specified patched versions immediately.\u003c/li\u003e\n\u003cli\u003eFor Prisma Access and Cloud NGFW, coordinate with Palo Alto Networks Support for scheduled maintenance or on-demand upgrades.\u003c/li\u003e\n\u003cli\u003eInventory all currently deployed PAN-OS instances across the environment to identify systems running vulnerable versions.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T21:54:03Z","date_published":"2026-11-11T21:54:03Z","id":"https://feed.craftedsignal.io/briefs/2026-11-panos-disclosure-cve-2026-0331/","summary":"An unauthenticated remote information disclosure vulnerability in PAN-OS allows attackers to exfiltrate firewall and session data via the dataplane interface.","title":"Palo Alto Networks PAN-OS: Sensitive Information Disclosure (CVE-2026-0331)","url":"https://feed.craftedsignal.io/briefs/2026-11-panos-disclosure-cve-2026-0331/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:palo_alto_networks:pan-os:12.2.4:*:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:12.1.10:h3:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.2.16:h1:*:*:*:*:*:*","cpe:2.3:o:palo_alto_networks:pan-os:11.1.16:h4:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-0327"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PAN-OS (\u003c 12.2.4-h2)","PAN-OS (\u003c 12.1.10-h4)","PAN-OS (\u003c 11.2.16-h2)","PAN-OS (\u003c 11.1.16-h5)","Prisma Access (\u003c 12.1.10-h4)"],"_cs_severities":["low"],"_cs_tags":["vulnerability","privilege-escalation","network-security"],"_cs_type":"advisory","_cs_vendors":["Palo Alto Networks"],"content_html":"\u003cp\u003eA privilege escalation vulnerability exists in the GlobalProtect gateway of Palo Alto Networks PAN-OS software. The issue allows an authenticated, lower-privileged user to obtain the privileges and configuration of a higher-privileged user. This vulnerability specifically affects firewalls with a GlobalProtect gateway configured to use an authentication profile that utilizes a RADIUS provider and issues a supported authentication challenge. Palo Alto Networks is not aware of any malicious exploitation of this issue. Cloud NGFW and Panorama are not affected.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated user to gain elevated privileges and access sensitive configuration data, potentially leading to unauthorized administrative control within the context of the GlobalProtect gateway.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eApply the vendor-provided patches for PAN-OS and Prisma Access immediately.\u003c/li\u003e\n\u003cli\u003eIf patching is not immediately feasible, change the GlobalProtect authentication profile to a non-challenge based method such as SAML, or enforce client certificate authentication using a Certificate Profile to mitigate the vulnerability.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T21:53:39Z","date_published":"2026-11-11T21:53:39Z","id":"https://feed.craftedsignal.io/briefs/2026-11-pan-os-globalprotect-priv-esc-cve-2026-0327/","summary":"A privilege escalation vulnerability in the GlobalProtect gateway of PAN-OS allows an authenticated, lower-privileged user to gain higher-privileged access when using RADIUS-based authentication challenges (CVE-2026-0327).","title":"Palo Alto Networks PAN-OS: GlobalProtect Privilege Escalation (CVE-2026-0327)","url":"https://feed.craftedsignal.io/briefs/2026-11-pan-os-globalprotect-priv-esc-cve-2026-0327/"}],"language":"en","title":"CraftedSignal Threat Feed - PAN-OS (\u003c 12.1.10-H4)","version":"https://jsonfeed.org/version/1.1"}